CVE-2026-35169: XSS in LORIS Neuroimaging Research System

Successful exploitation of CVE-2026-35169 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the LORIS server. This can lead to session hijacking, data theft (including sensitive research data), and defacement of the LORIS interface. The ability to download arbitrary markdown files expands the attack surface, potentially allowing attackers to exfiltrate configuration files or other sensitive data stored on the server. The impact is amplified in environments where LORIS is used to manage highly sensitive neuroimaging data, as a successful attack could compromise the integrity and confidentiality of research findings.

1. Reserved2026-04-01
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-35169 is to immediately upgrade LORIS to version 27.0.3 or 28.0.1. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter out potentially malicious input in the help_editor module. Carefully review and sanitize all user-supplied input before rendering it in the LORIS interface. Monitor LORIS logs for suspicious activity, particularly requests containing unusual characters or patterns that could indicate an attempted XSS attack. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known payload and verifying that the script is not executed.